PT0-002 Engagement Management Practice Test 4 — 15 Questions

Question 1

A penetration testing engagement requires testing a production environment during business hours. The client is concerned about potential service disruption. Which document should specify the conditions under which the test must be halted?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Rules of Engagement. The Rules of Engagement (RoE) is the definitive document that outlines the scope, authorization, and constraints of a penetration test, including explicit conditions under which testing must be halted to prevent service disruption. Unlike other documents, the RoE is a legally binding agreement that specifies technical boundaries such as IP ranges, testing windows, and stop conditions (e.g., CPU threshold exceeded or application error rate spike). This ensures the client's production environment is protected during business hours.

Answer

Get-out-of-jail letter

Answer

Communication plan

Answer

Statement of Work

Question 2

During a social engineering engagement, a tester is authorized to target employees via email phishing. However, the tester accidentally sends a phishing email to a contractor who is not listed in the personnel scope. The contractor reports the email to the client's security team, causing an internal investigation. Which of the following best describes the tester's mistake?

Accepted Answer

Failure to follow the Rules of Engagement. Personnel scope must be clearly defined; the tester failed to adhere to the scoping requirements for social engineering.

Answer

Breach of the Non-Disclosure Agreement

Answer

Mishandling of discovered criminal activity

Answer

Violation of the Computer Fraud and Abuse Act (CFAA)

Question 3

A penetration tester is conducting a red team exercise. The goal is to simulate an advanced persistent threat (APT) and test the organization's detection and response capabilities. Which of the following engagement types best describes this scenario?

Accepted Answer

Red team exercise. A red team exercise (Option B) is the correct engagement type because it simulates an advanced persistent threat (APT) by emulating real-world adversarial tactics, techniques, and procedures (TTPs) across multiple attack vectors, with the primary objective of testing the organization's detection and response capabilities. Unlike a standard penetration test, a red team exercise is goal-oriented (e.g., gaining access to a specific system or data) and often operates under a covert or no-notice scenario, requiring the team to bypass security controls and evade detection over an extended period.

Answer

Wireless penetration test

Answer

Network penetration test

Answer

Web application penetration test

Question 4

Which of the following is the primary purpose of a get-out-of-jail letter?

Accepted Answer

To provide legal authorization for the tester to perform the test. A get-out-of-jail letter provides authorization and protects the tester from legal liability when performing authorized tests.

Answer

To outline the deliverables

Answer

To establish a communication plan

Answer

To define the rules of engagement

Question 5

A client requests a penetration test that includes testing of both internal network devices and a public-facing web application. The tester is provided with a VPN account for internal access but no credentials for the web application. Which type of penetration test is this?

Accepted Answer

Grey box. Grey box testing involves partial knowledge; the tester has internal network access but not web app credentials.

Answer

White box

Answer

Red team

Answer

Black box

Question 6

During a penetration test, the tester discovers evidence of an ongoing criminal activity, such as unauthorized data exfiltration by an insider. The client's legal team has not provided specific guidance on handling such discoveries. According to best practices and legal considerations, what should the tester do first?

Accepted Answer

Stop testing and report the finding to the client immediately. The tester should immediately stop testing and report the finding to the client's point of contact without further investigation. This preserves evidence, avoids legal complications, and allows the client to handle the situation appropriately. Contacting law enforcement directly or continuing testing could jeopardize the investigation or violate laws. Ignoring the finding is unethical and could lead to legal liability.

Answer

Continue testing to gather more evidence

Answer

Contact law enforcement directly

Answer

Ignore the finding as it is out of scope

Question 7

A penetration tester is preparing a proposal for a client. The client wants a test that includes a detailed technical report with remediation steps and an executive summary for management. Which standard or framework is most commonly used to structure the testing process from pre-engagement through post-engagement?

Accepted Answer

PTES. The Penetration Testing Execution Standard (PTES) provides a comprehensive framework covering all phases from pre-engagement to post-engagement.

Answer

OWASP Testing Guide

Answer

OSSTMM

Answer

NIST SP 800-115

Question 8

After completing a penetration test, the tester must submit deliverables and then destroy all test artifacts. Which legal or ethical consideration primarily drives the requirement to destroy test artifacts?

Accepted Answer

The statement of work (SOW) and NDA. Data handling and destruction are required to protect client confidentiality and comply with privacy laws and contractual agreements.

Answer

Privacy laws such as GDPR or HIPAA

Answer

Computer Fraud and Abuse Act (CFAA)

Answer

Vulnerability disclosure responsibilities

Question 9

A penetration tester is scoping a network penetration test for a client that uses multiple third-party services. Which TWO of the following are correct actions regarding third-party services? (Select TWO.)

Accepted Answer

Exclude third-party services from testing unless explicitly authorized. Third-party services are outside the penetration tester's authorized boundary unless explicitly included in the scope definition. Testing without explicit authorization could violate the third-party's terms of service, the Computer Fraud and Abuse Act (CFAA), or similar laws. Scope must be clearly defined in the Rules of Engagement (RoE) to avoid legal and contractual breaches.

Answer

Include all third-party services in scope without restriction

Answer

Assume that third-party services are out of scope

Answer

Test third-party services without informing the provider

Question 10

A penetration testing company is planning a social engineering engagement for a client. The engagement includes phishing and physical tailgating. Which THREE of the following should be clearly defined in the Rules of Engagement? (Select THREE.)

Accepted Answer

The conditions under which the test must be stopped immediately. RoE should address personnel scope, emergency stop conditions, and specific techniques allowed; vulnerabilities and deliverables are part of SOW.

Answer

The format of the final report

Answer

The specific vulnerabilities to be exploited

Question 11

A penetration tester has completed a web application test and is preparing the final deliverables. According to best practices, which THREE components should be included in the deliverables? (Select THREE.)

Accepted Answer

Detailed technical findings with evidence. Penetration testing deliverables must include detailed technical findings with evidence, such as proof-of-concept exploit code, HTTP request/response pairs, or screenshots, to validate each vulnerability. This aligns with PT0-002 best practices, ensuring the client can reproduce and understand the issue without ambiguity.

Answer

Raw vulnerability scan output

Answer

Full source code of the application

Question 12

A penetration tester is hired to assess the security of a company's internal network. The client provides the tester with full network diagrams, credentials, and source code. Which type of penetration test is being performed?

Accepted Answer

White box. White box testing provides the tester with full knowledge and credentials, which matches the scenario.

Answer

Grey box

Answer

Black box

Answer

Red team

Question 13

During the pre-engagement phase, a penetration tester and the client agree on the specific IP ranges to be tested, testing windows, and what constitutes an emergency stop condition. Which document typically contains these details?

Accepted Answer

Rules of Engagement (RoE). The Rules of Engagement (RoE) document is specifically designed to define the scope, authorization, and constraints of a penetration test, including target IP ranges, testing windows, and emergency stop conditions. This ensures both the tester and client have a clear, legally binding agreement on how the test will be conducted, preventing misunderstandings or unauthorized actions.

Answer

Non-Disclosure Agreement (NDA)

Answer

Get-out-of-jail letter

Answer

Statement of Work (SOW)

Question 14

A penetration tester is contracted to perform a web application test for a company that hosts its application on a third-party cloud provider. The tester discovers a critical vulnerability that could allow access to other customers' data on the same cloud platform. Which legal consideration is MOST important for the tester to address?

Accepted Answer

Obtain a new get-out-of-jail letter for the cloud provider. When a penetration tester discovers a vulnerability that could affect other customers on a shared cloud platform, the tester's scope is limited to the target application. To legally test beyond scope (e.g., verify impact on other tenants), a new authorization, such as an updated get-out-of-jail letter covering the cloud provider, must be obtained. Notifying law enforcement is premature unless criminal activity is confirmed.

Answer

Exploit the vulnerability to demonstrate impact

Answer

Include the finding in the final report without further action

Answer

Notify law enforcement of the criminal activity

Question 15

A penetration testing company is scoping a social engineering engagement for a client. The client wants to test employee awareness of phishing attempts. Which of the following should be included in the scope?

Accepted Answer

A defined subset of employees agreed upon in advance. Social engineering engagements require explicit, pre-agreed boundaries to ensure legal and ethical compliance. Including a defined subset of employees allows the client to control risk, avoid disrupting critical operations, and obtain informed consent, which is essential for a valid penetration test scope.

Answer

All employees including the CEO

Answer

External contractors only

Answer

Only non-technical staff